test: fuzz bounded protocol parsers

internal/agentproto/validate_test.go

@@ -42,6 +42,35 @@ func TestDecodeEnvelopeBoundaries_HP_PROTO_01(t *testing.T) {
 	}
 }
 
+func FuzzDecodeEnvelopeBounded_SEC_PROTO_01(f *testing.F) {
+	valid, err := proto.Marshal(&rvboxv1.AgentEnvelope{Payload: &rvboxv1.AgentEnvelope_ClientHello{ClientHello: validHello()}})
+	if err != nil {
+		f.Fatal(err)
+	}
+	f.Add(valid)
+	f.Add([]byte{0xff})
+	f.Fuzz(func(t *testing.T, data []byte) {
+		limits := DefaultLimits()
+		if len(data) > int(limits.MaxEnvelopeBytes)+1 {
+			return
+		}
+		_, _ = DecodeEnvelope(data, limits, rvboxv1.Platform_PLATFORM_WINDOWS)
+	})
+}
+
+func FuzzDecodeOutputChunkBounded_SEC_PROTO_02(f *testing.F) {
+	f.Add([]byte("plain"), uint8(rvboxv1.Compression_COMPRESSION_NONE), uint64(5))
+	f.Add([]byte{0x28, 0xb5, 0x2f, 0xfd}, uint8(rvboxv1.Compression_COMPRESSION_ZSTD), uint64(1))
+	f.Fuzz(func(t *testing.T, data []byte, compression uint8, rawBytes uint64) {
+		const limit = uint64(64 << 10)
+		if len(data) > int(limit) {
+			return
+		}
+		chunk := &rvboxv1.OutputChunk{Stream: rvboxv1.StreamKind_STREAM_STDOUT, Compression: rvboxv1.Compression(compression % 3), CompressedSize: uint64(len(data)), UncompressedSize: rawBytes % (limit + 2), Data: data}
+		_, _ = DecodeOutputChunk(chunk, limit)
+	})
+}
+
 func TestEnvelopeSessionFencingShape_BH_SES_01(t *testing.T) {
 	t.Parallel()